Issues

• Bucket drains faster than leakRate: the post-leak level is rounded down (st0x.attest SPEC item 14)

  adversarialaudit
  S01-Issuer/st0x.deploy#401 · Filter by author thedavidmeister opened on Oct 1, 2026

• Rounding goes with the minter: LibLeakyBucket.headroomAt can report more headroom than capacity - level (st0x.attest SPEC item 14)

  adversarialaudit
  S01-Issuer/st0x.deploy#400 · Filter by author thedavidmeister opened on Oct 1, 2026

• Bucket does not fill at least as fast as the true value: LibLeakyBucket.fill records level + charge rounded down (st0x.attest SPEC item 14)

  adversarialaudit
  S01-Issuer/st0x.deploy#399 · Filter by author thedavidmeister opened on Oct 1, 2026

• Rounding goes with the minter: mul(mint-amount() lead-price()) truncates the charge toward zero (st0x.attest SPEC item 14)

  adversarialaudit
  S01-Issuer/st0x.deploy#398 · Filter by author thedavidmeister opened on Oct 1, 2026

• Move the mint caps onto the leaky bucket struct API once 0.2.0 publishes

  S01-Issuer/st0x.deploy#393 · Filter by author thedavidmeister opened on Sep 22, 2026
  1

• A rebase silently rescales every mint cap, and loosens them on a consolidation

  S01-Issuer/st0x.deploy#390 · Filter by author thedavidmeister opened on Sep 22, 2026
  2

• Per-minter mint caps on the orchestrator via a leaky bucket

  enhancement
  S01-Issuer/st0x.deploy#382 · Filter by author thedavidmeister opened on Sep 22, 2026
  1

• forge build --deny warnings fails on main

  S01-Issuer/st0x.deploy#378 · Filter by author thedavidmeister opened on Sep 14, 2026

• BSC carries a second, unpinned set of 41 token vaults from run 34542307257 — record it as orphaned (or re-pin to it)

  S01-Issuer/st0x.deploy#364 · Filter by author alastairong1 opened on Sep 11, 2026

• SECURITY: the orchestrator beacon is owned by a compromised EOA on all three chains; #324 must not run until it is moved

  S01-Issuer/st0x.deploy#335 · Filter by author thedavidmeister opened on Aug 29, 2026
  1

• Protofire 5.0 and 6.0 reports are cited across the tree but not in audit/protofire/

  S01-Issuer/st0x.deploy#327 · Filter by author thedavidmeister opened on Aug 27, 2026
  1

• Orchestrator instance uses nonce-derived CREATE on a permissionless deploy(); use the rain-factory clone factory the repo already depends on

  S01-Issuer/st0x.deploy#326 · Filter by author thedavidmeister opened on Aug 27, 2026

• build-artifact + rainix-sol test red on main: live-chain grant/pin drift

  S01-Issuer/st0x.deploy#322 · Filter by author thedavidmeister opened on Aug 22, 2026

• foundry.toml's bare [package] warns on every forge invocation, and forge's suggested fix makes it worse

  S01-Issuer/st0x.deploy#313 · Filter by author thedavidmeister opened on Aug 17, 2026
  

• Nothing verifies the token tables are COMPLETE — enumerate deployments from chain, not from the pins

  S01-Issuer/st0x.deploy#297 · Filter by author thedavidmeister opened on Aug 10, 2026
  

• Beacon-set deployers: resolve BEACON_INITIAL_OWNER from the address registry so rotating it stops moving the Zoltu address

  S01-Issuer/st0x.deploy#296 · Filter by author thedavidmeister opened on Aug 8, 2026
  1

  

• Authoriser: resolve initial admin from the address registry and deploy via open salt, so the pin stops depending on the deploy EOA

  S01-Issuer/st0x.deploy#295 · Filter by author thedavidmeister opened on Aug 8, 2026
  1

  

• Hash-only and address-only pins across the repo: embed runtime bytecode on every deployed-artifact pin (ruling from #250)

  S01-Issuer/st0x.deploy#293 · Filter by author thedavidmeister opened on Aug 4, 2026
  

• Deterministic authoriser clones everywhere: chain-invariant address, pinned up-front, migrate Base off the nonce-based clone

  S01-Issuer/st0x.deploy#292 · Filter by author thedavidmeister opened on Aug 4, 2026
  2

  

• Authoriser grant invariant is presence-only: a post-deploy _ADMIN re-grant is invisible

  S01-Issuer/st0x.deploy#281 · Filter by author thedavidmeister opened on Jul 23, 2026
  

• Four independent per-chain dispatch sites — adding a chain fails at broadcast time, not compile time

  S01-Issuer/st0x.deploy#272 · Filter by author thedavidmeister opened on Jul 22, 2026
  

• Scripts as migrations: on-chain migration registry, state-relevant tests, drop the deadline-gated dual-state invariant

  S01-Issuer/st0x.deploy#256 · Filter by author thedavidmeister opened on Jul 15, 2026
  

• Convert BuildPointers to the shared LibSnapshot (drop the local copy + reconcile deployTags divergence)

  S01-Issuer/st0x.deploy#251 · Filter by author thedavidmeister opened on Jul 15, 2026
  1

  

• Deploy the V4 authoriser clone deterministically via Zoltu (pin up-front, retire #211)

  S01-Issuer/st0x.deploy#248 · Filter by author thedavidmeister opened on Jul 11, 2026
  3

  

• st0x-deploy release lifecycle: foundry.toml = next version, generate-into-it, publish+bump+regenerate on merge

  S01-Issuer/st0x.deploy#244 · Filter by author thedavidmeister opened on Jul 9, 2026